Full Packet Capture (FPC). Those three little words are enough to make most security analysts salivate at the prospect of finding and detecting attacks.

According to David Gray, practice consultant at RSA, The Security Division of EMC, back in the days before anyone realised that you could build an intrusion prevention system to actually stop attacks, the intrusion detection system was king.

"If you were very lucky, you had the support to build a Linux/ Unix server running TCP dump. Life as an analyst was good, all you had to worry about was what was happening on the wire, and once you found an attack it was somebody else's problem to resolve. We have surely moved on a bit from those days," he says.

Gray notes that, whilst detection systems have become more advanced and the integration of security systems has become a key selling point for many vendors, "FPC is still enough to make any security analyst get sweaty palms".
"There are many other security tools that give you an overall threat picture including RSA's own Archer and NetWitness Platforms," he continues, "some vendors pull in only log sources (SIEMs) which most analysts had forgotten to check for years. Packets are where it's at – everything that passes the sensor on the wire is recorded and can be analysed immediately or later - depending upon your storage space. The FPV has been the TIVO of the security world. However these days it is all about the full picture of logging with SIEMs and threat intelligence."

There are few times that a security analyst can conduct an investigation from one source of information and categorically give a confirmation of a true or false positive status. In most events (logs), the analyst has to pull in a number of corroborating facts before an event can be confirmed, and in many serious cases a full host forensic examination is required. "Not so with packets," highlights Gray. "If the traffic you are analysing is on the inside of your network and you have confirmed it to be malicious, you are going to have a busy day. That said, you have a copy of the malicious traffic and can create custom signatures to identify the scope of the issue and block it. In the case of files you also have the hash value and can search your network for other identical threats. This is of course assuming you know how to read packets and therein lies the first chink in the armour."

Packet analysis is not easy, he cautions. "Sure, you can fire up Wireshark and if you already know the traffic you are looking for it is relatively simple to isolate a stream and extract it for analysis, but if you don't, then a lot of deep analysis is required. This is the first major issue. Any SOC that is running any kind of FPC requires a highly trained workforce, which is an expensive resource and is hard to find these days. Secondly and probably the greatest issue is you are recording all of the traffic. This issue is especially difficult for multinational organisations, which have to comply with rigorous privacy laws: an example of this is Germany, which has one of the strictest privacy laws in the world. In this sort of situation it is unlikely that a FPC solution will be deployable without a serious number of constraints on the mission statement and the analysts' taskings," says Gray.

Those issues notwithstanding, packet analysis is a key skill for any SOC analyst. With a well-staffed and motivated team, attackers will face a hard time compromising a network without facing rapid detection.

Adds Gray: "APT (Advanced Persistent Threat) has been both a major threat to government organisations and companies alike, and formed a part of any security vendors' sales guide. If you are serious about detecting APT or any other advanced threats to your network, packets are the most effective way of identifying what has happened. Yes, your SIEM may alert on unusual IDS traffic or logons to a server/ host remotely with elevated privileges, now what? Packets give you the granularity to identify exactly what has happened, how the attack occurred, what was exfiltrated, protocols used. If the attack is still ongoing you can even go as far as monitoring the command and control (C2) traffic to see what commands the attacker is issuing and decide at what point to take remediation actions to resolve the breach."

He details PoisonIvy as an example of just how packet analysis (and network signatures) can be used to detect attacks. PoisonIvy is one of the most infamous of Remote Access Tools (RATs), which has been used in many APT attacks across all verticals. PoisonIvy begins with 256 bytes of seemingly random data. Once it has completed its TCP handshake, this information coupled with its most common ports 80, 443 and 8080 (as well as its default port of 3460) can give a good initial detection capability. This can be strengthened if the rule logic also contains the four bytes sent by the controller specifying the size of the machine code it will send. Over the versions of PoisonIvy seen this has consistently been "D0 15 00 00".

"This is just one example, however, it shows how the analysis of a threat coupled with the known network indicators can give a good detection capability. Time to start writing some content rules!" exclaims Gray.

He says that there is one other huge benefit which is really only available to either companies with a large enough budget or a government organisation; storing multiple months' worth of network traffic and replaying them with the very latest IDS/IPS signature set. "As your SOC team has already dealt with the traffic in real time, the signature set can be created from only the vulnerabilities and zero days, which have become public after compromises have taken place. Replaying the traffic in this way enables organisations to go back in time with modern detection methods and detect previously unknown attacks and remediate effectively.

"Finally when you take the logs from the IDS/IPS and review them in correlation with other network logs you have a very strong set of defensive measures.
You monitor your logs…right?" concludes Gray.

Value-added distributor, Networks Unlimited distributes RSA solutions in more than 20 African countries. For more information please contact Angela Bethell, RSA product manager at Networks Unlimited at angela.bethell@nu.co.za